FTC Safeguards Rule Compliance Checklist for Small Financial Businesses
Tax preparers, mortgage brokers, auto dealers and lenders must follow the FTC Safeguards Rule. Here are its required elements, breach notice rules and a checklist.
If your business offers financing, prepares taxes, brokers mortgages, leases vehicles long-term or provides other financial services to consumers, the FTC Safeguards Rule (16 CFR Part 314) probably applies to you, even though you are not a bank. It requires a written information security program with specific elements: a Qualified Individual in charge, a written risk assessment, encryption, multi-factor authentication, testing, staff training, vendor oversight, an incident response plan and an annual report to leadership. Since May 2024 it also requires notifying the FTC within 30 days of discovering a breach that affects at least 500 consumers. This guide explains each element in plain language and ends with a checklist. It is general information, not legal advice: confirm with your attorney whether and how the Rule applies to your business.
Who the Safeguards Rule covers
The Rule applies to "financial institutions" under the FTC's jurisdiction, which means businesses that are significantly engaged in financial activities and are not regulated by a banking agency or the SEC. The FTC stresses that the test is the activity, not what you call your company. The examples listed in the Rule (16 CFR 314.2) include:
- Mortgage lenders and mortgage brokers
- Payday lenders, finance companies and check cashers
- Account servicers, wire transferors and collection agencies
- Credit counselors and other financial advisors
- Tax preparation firms
- Investment advisors that are not required to register with the SEC
- Non-federally insured credit unions
- An automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days
- "Finders" that bring buyers and sellers of a product or service together
In South Florida this commonly includes independent tax and bookkeeping practices, mortgage brokerages, auto dealers and consumer lenders. If you are unsure, ask counsel: the definition is broad and the details matter.
The required elements (16 CFR 314.4)
The FTC summarises the program as nine elements. Here is what each means in practice.
1. Designate a Qualified Individual
One person oversees and enforces the program. It can be an employee, or someone at an affiliate or service provider such as your IT company. If you use an outside provider, your business remains responsible for compliance, must name a senior staff member to supervise that person, and must require the provider to maintain a program that meets the Rule.
2. Write a risk assessment
A written assessment of reasonably foreseeable internal and external risks to customer information. It must include criteria for evaluating and categorising risks, an assessment of confidentiality, integrity and availability, and how each risk will be mitigated or accepted. Repeat it periodically.
3. Design and implement safeguards
Based on the risk assessment, the Rule lists specific controls, including:
- Access controls: only authorised users, with access limited to what each person needs.
- Data and system inventory: know what data you hold, where it lives and which systems process it.
- Encryption of customer information in transit over external networks and at rest. If that is not feasible, the Qualified Individual must review and approve alternative controls.
- Secure development practices for in-house applications, and procedures to evaluate apps you buy.
- Multi-factor authentication for any individual accessing any information system (or equivalent controls the Qualified Individual approves in writing).
- Secure disposal of customer information no later than two years after it was last used for the customer, unless there is a business or legal reason to keep it, plus periodic review of your retention policy.
- Change management procedures.
- Logging and monitoring of authorised users' activity, and detection of unauthorised access.
4. Monitor and test
Either continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months and whenever there are material changes to your operations.
5. Train your staff
Security awareness training for everyone, updated as risks change, and qualified security personnel (in-house or outsourced) who keep their knowledge current.
6. Oversee service providers
Choose providers that can protect customer information, require safeguards by contract, and periodically assess them based on the risk they present. This includes cloud software, payroll, document storage and your IT provider.
7. Keep the program current
Evaluate and adjust the program based on testing results, material changes to your business, risk assessment findings and anything else that could materially affect it.
8. Write an incident response plan
A written plan covering goals, internal processes, clear roles and decision authority, internal and external communications, remediation of weaknesses, documentation and reporting, and a review after each incident.
9. Report to leadership at least annually
The Qualified Individual reports in writing, at least once a year, to the board of directors or equivalent governing body (or to a senior officer if there is no board), covering the program's overall status and material matters such as risk decisions, test results and security events.
The FTC breach notification requirement
Since the amendment took effect in May 2024, a covered business must notify the FTC of a "notification event": the acquisition of unencrypted customer information without the consumer's authorisation, involving at least 500 consumers. Information is treated as unencrypted if the encryption key was also accessed by an unauthorised person.
- Deadline: as soon as possible and no later than 30 days after discovery.
- Discovery: the first day the event is known to anyone at your business other than the person who committed it.
- How: electronically, through the form on the FTC's website. The FTC says reports may be made public.
- Law enforcement delay: if law enforcement determines that public disclosure would impede an investigation, it can request a delay of up to 30 days, which may be extended by up to another 60 days with a written request.
This is separate from any state breach notification law (Florida has its own, section 501.171 of the Florida Statutes), so your incident response plan should cover both. Encryption matters twice here: it protects the data, and properly encrypted data with a protected key does not trigger the FTC notice.
The small-business exemption (fewer than 5,000 consumers)
If your business maintains customer information concerning fewer than 5,000 consumers, Section 314.6 exempts you from four requirements:
- the written risk assessment (314.4(b)(1)),
- the continuous monitoring or annual penetration testing and six-month vulnerability assessments (314.4(d)(2)),
- the written incident response plan (314.4(h)),
- the annual written report to the board (314.4(i)).
Everything else still applies, including the Qualified Individual, encryption, MFA, training, vendor oversight and the FTC notification requirement. In practice, a short written risk assessment and incident plan are still worth having, because they make the other controls much easier to justify and maintain.
Safeguards Rule checklist
Use this list to see where you stand. Each item maps to the sections above.
- Confirm with counsel whether your business is a covered financial institution
- Count the consumers whose information you maintain (5,000 threshold)
- Name the Qualified Individual in writing (and a senior supervisor if outsourced)
- Complete a written risk assessment and set a date to repeat it
- Inventory customer data, where it is stored and who can access it
- Review user access and remove what people do not need
- Encrypt laptops, servers, backups and data sent over external networks
- Turn on MFA for email, remote access, line-of-business apps and admin accounts
- Set a disposal schedule (two years after last use, unless you must keep it)
- Enable logging of user activity and alerts for suspicious sign-ins
- Schedule penetration testing and vulnerability scans, or continuous monitoring
- Run security awareness training and keep attendance records
- List service providers, check their contracts and review their safeguards
- Write and test an incident response plan that includes the FTC 30-day notice and Florida's notice rules
- Deliver the Qualified Individual's annual written report
Many of these controls overlap with good general practice, such as the steps in our ransomware prevention guide and Microsoft 365 security settings.
If you would like help with the technical side of the Safeguards Rule (MFA, encryption, logging, vulnerability scanning, vendor reviews and a written incident plan), request a free IT assessment. Core Florida IT supports financial service businesses across Miami-Dade and South Florida through our cybersecurity services, working alongside your attorney or compliance advisor rather than replacing them.
